PostFukushima

Ukraineaccident

Peer review
countryreportStress tests
performed on
European nuclear
power plants

S t r e s s Te s t P e e r R e v i e w B o a r d

1

GENERAL QUALITY OF NATIONAL REPORT AND NATIONAL
ASSESSMENTS ................................................................................................................. 3

1.1
1.2
1.3
1.4
1.5
2

Compliance of the national reports with the topics defined in the ENSREG stress tests
specifications ....................................................................................................................... 3
Adequacy of the information supplied, consistency with the guidance provided by
ENSREG ............................................................................................................................. 4
Adequacy of the assessment of compliance of the plants with their current
licensing/safety case basis for the events within the scope of the stress tests ..................... 4
Adequacy of the assessments of the robustness of the plants: situations taken into
account to evaluate margins ................................................................................................ 4
Regulatory treatment applied to the actions and conclusions presented in national
report ................................................................................................................................... 5
PLANT(S) ASSESSMENT RELATIVE TO EARTHQUAKES, FLOODING AND
OTHER EXTREME WEATHER CONDITIONS .............................................................. 5

2.1
2.2
2.3
3

Description of present situation of plants in country with respect to earthquake ............... 5
Description of present situation of plants in country with respect to flood ...................... 10
Description of present situation of plants in country with respect to extreme weather .... 12
PLANT(S) ASSESSMENT RELATIVE TO LOSS OF ELECTRICAL POWER AND
LOSS OF ULTIMATE HEAT SINK................................................................................ 15

3.1
3.2
3.3
4

Description of present situation of plants in country ........................................................ 15
Assessment of robustness of plants ................................................................................... 16
Peer review conclusions and recommendations specific to this area ................................ 21
PLANT(S) ASSESSMENT RELATIVE TO SEVERE ACCIDENT MANAGEMENT . 21

4.1
Description of present situation of plants in Country........................................................ 21
4.2
Assessment of robustness of plants ................................................................................... 23
4.3
Peer review conclusions and recommendations specific to this area ................................ 28
List of acronyms ............................................................................................................................ 29

2

1

GENERAL QUALITY OF NATIONAL REPORT AND NATIONAL
ASSESSMENTS

The accident at the Fukushima nuclear power plant in Japan on 11th March 2011 triggered the need fora coordinated action at EU level to identify potential further improvements of Nuclear Power Plant
safety. On 25th March 2011, the European Council concluded that the safety of all EU nuclear plants
should be reviewed, on the basis of comprehensive and transparent risk and safety assessments - thestress tests. Some EU neighbouring countries, including Ukraine, joined the stress tests exercise as
well as the ensuing peer-review process. The stress tests consist in three main steps: a self-assessment
by licensees, followed by an independent review by the national regulatory bodies, and by a third
phase of international peer reviews. The international peer review phase consists of 3 steps: an initialdesktop review, three topical reviews in parallel (covering external initiating events, loss of electricalsupply and loss of ultimate heat sink (UHS), and accident management), and seventeen individual
country peer reviews.
Country review reports are one of the specific deliverables of the EU stress tests peer review process.
They provide information based on the present situation with respect to the topics covered by thestress tests. They contain specific recommendations to the participating national regulator for theirconsideration or good practices that may have been identified, and to some extent information specificto each country and installation. Draft country review reports were initiated during the topical reviews
based on discussions with the country involved in the three topics and on the generic discussions
within each of the three topical reviews. Issues identified for each country during the topical reviews,
due to only limited time available for each country, have required follow-up discussions in more detail,both between the topical reviews and the country reviews, and during the country reviews. The current
Country Report was finalized at the end of the Country Review, after final discussion with thereviewed country and visit to the South Ukraine nuclear power plant (SUNPP). It is a part of the Final
ENSREG Report combining the results of the Topical Reviews and Country Reviews.

1.1

Compliance of the national reports with the topics defined in the ENSREG stresstests specifications

The structure of the report is in compliance with the ENSREG specifications and complies to a large
extent with the guidance provided in the specifications.
According to the report, there are four sites with operating nuclear power plants (NPPs): Zaporizhzhya,
Khmelnitsky, Rivne, and South Ukraine. All operating NPPS are Water-Water Energetic/pressurizedwater Reactors (WWER), operated by NNEGC (National Nuclear Energy Generating Company)“Energoatom”:– Six WWER-1000/V-320 at the Zaporizhzhya site (ZNPP); this includes a Dry Spent Fuel Storage
Facility (SF) that has been included in the stress test review,– One WWER-1000/V-302, one WWER-1000/V-338, one WWER-1000/V-320 at South Ukrainesite,– Two WWER-440/V-213 (in 2010, both reactors received 20 year life extensions), two WWER1000/V-320 in Rivne site (RNPP),– Two WWER-1000/V-320 at the Khmelnitsky site(KhNPP).
In addition the report includes the Chornobyl site (ChNPP), including:– Three High Power Channel-type Reactors (RBMK)-1000 (under decommissioning),– One Wet Interim Spent Nuclear Fuel Storage Facility (ISF-1).
The destroyed RBMK (unit 4) has not been included in the scope of the current stress tests. This site is
located within the 30 km exclusion zone defined after the 1986 accident.

3

1.2

Adequacy of the information supplied, consistency with the guidance provided by
ENSREGThe national report provides sufficient information to understand the design basis for external natural
events. The adequacy of the information supplied in the report is in general broadly consistent with theguidance provided by ENSREG. However, the national report does not contain sufficient detail toallow judgement on some of its conclusions. The country representatives provided answers andclarifications to the review questions during the Topical review meeting in Luxembourg. In the courseof the country visit, the missing information was addressed.

1.3

Adequacy of the assessment of compliance of the plants with their current
licensing/safety case basis for the events within the scope of the stress tests

The national report provides satisfactory evidence that the plants are compliant with their original
design basis for all external natural events. A deterministic approach has been applied for hazard
assessment.
During the topical review meeting, references have been provided for the main existing Ukrainian
regulatory requirements. It is stressed that compliance of the plants is mostly discussed in relation to
the independent safety assessment of the Ukrainian NPPs carried out in the framework of the common
EC-IAEA-Ukraine projects (e.g. Memorandum of Understanding on Cooperation in the Field ofEnergy between the European Union and Ukraine).
Under the framework of a ‘design safety assessment’, Ukrainian NPPs are found to be compliant with172 of 194 requirements of International Atomic Energy Agency (IAEA) NS-R-1 ‘Safety of Nuclear
Power Plants: Design’. Issues that were found to be not fully compliant included: equipment
qualification, consideration of severe accidents, NPP seismic resistance, completeness of probabilisticand deterministic safety analysis, and post-accident monitoring. Accordingly, Western European
Nuclear Regulators’ Association (WENRA) reference levels on severe accident are not yet fulfilled.
These non-full compliances represent a significant weakness in demonstrating the robustness of
Ukrainian NPPs in the context of the stress tests. The schedule of activities to achieve full compliance
was discussed as a priority issue during the country visit. Implementation of necessary improvements
is on-going under the recently adopted Upgrade Package (e.g. Comprehensive (Integrated) Safety
Improvement Program for Ukrainian NPPs (C(I)SIP)). Scheduled completion of the main
improvements is 2012-2017. It is recommended that the national regulator considers giving priority toachieving or enhancing this schedule. This should include due consideration of the parallel needs
arising from envisaged long term operation.
Addressing most of these issues forms part of the licensing basis for lifetime extension: robustness ofsafety equipment at 0.1g/0.12g, seismic loading, performance of main safety functions in 'harsh'
environments, containment venting for WWER-1000, measures to ensure Steam Generator (SG) andSpent Fuel Pool (SFP) make-up under Station Black Out (SBO) and loss of UHS.

1.4

Adequacy of the assessments of the robustness of the plants: situations taken into
account to evaluate margins

The beyond design basis capability is described and discussed in the national report, and safetymargins are defined. The assessment as such was done by comparison of extreme values of theparameters with the design basis for selected external natural events.
The national report addresses the robustness of the plants and the respective safety margins against
earthquakes, flooding, extreme weather conditions, loss of off-site power (LOOP) and loss of the UHC.
Safety upgrades to improve the plants' robustness according to the stress test conditions are still in theplanning and implementation phase.
As far as the management of severe accidents and emergencies are concerned, existing provisions,
including organizational arrangements, hardware measures and procedural arrangements are presented
in the report. Severe Accident Management Guidelines (SAMG) have not yet been implemented at
Ukrainian NPPs, and the national report mentions principles on which they are planned to beestablished in future.

4

1.5

Regulatory treatment applied to the actions and conclusions presented in national
reportBased on a first evaluation of the Fukushima accident, the scope and timeframe for implementation of
improvement measures at the Ukrainian NPPs have been revised in line with their importance andurgency. In May 2011 the Regulator approved an action plan for a targeted reassessment and further
safety improvement of Ukrainian NPPs in the light of Fukushima.
Measures were identified during the Stress Test to increase reliability and availability of power supply
to safety systems. To ensure alternate UHS realization of different measures are ongoing underC(I)SIP. According to the national report, the Stress Tests revealed no safety issues that were not
identified previously and demonstrated relevance of the safety improvement measures under C(I)SIP.
−
Operating NPPs
According to the national report, measures identified in the lessons learned from the Fukushima
accident and during the ENSREG Stress Tests process have already been incorporated by the regulator
into the ‘Comprehensive Safety Improvement Program’. This program received ‘national-level
program’ status and its scope and funding were agreed by the Ukrainian government on 7 December
2011.
As set out in the regulator's Resolution No. 13 of 24-25 November 2011, approval to extend thelifetime of Ukrainian NPPs beyond 30 years requires the operator to fully implement the following
measures:− ensure robustness of equipment, piping, buildings and structures required for the main safetyfunctions to seismic impacts >0.1 g (0.12g for the SUNPP);− ensure performance of the main safety functions by NPP equipment in ‘harsh’ environments;− implement containment venting systems at WWER-1000 plants;− implement measures to ensure SG and SFP makeup (cool-down) under long-term SBO and/or lossof the UHS;
− introduce SAMGs related to both the reactor and the spent fuel pools as well as symptom-based
Emergency Operating Procedures (EOP) for shutdown states at NPP units.
Except for the implementation of a containment venting system, the above mentioned regulatory
requirements are, in general, a request for an acceleration of the implementation of earlier establishedimprovement programs.
−
Chornobyl site
The measures to improve resistance of nuclear facilities to external hazards, ensure safety of nuclear
facilities in loss of power and/or UHS, manage accidents and mitigate their consequences are specified
in the ‘Safety Improvement Plan for ChNPP Nuclear Installations’ have been agreed with the regulator.
In 2011, a mobile DG was provided at the ChNPP site.

2
2.1

PLANT(S) ASSESSMENT RELATIVE TO EARTHQUAKES,FLOODING AND OTHER EXTREME WEATHER CONDITIONS
Description of present situation of plants in country with respect to earthquake

2.1.1

Design Basis Earthquake (DBE)

2.1.1.1

Regulatory basis for safety assessment and regulatory oversight (national requirements,
international standards, licensing basis already used by another country,…)
In the national report no specific information is provided for the regulatory system, the regulatory
basis for safety assessment, and the requirements of the applicable regulations and/or licensing
conditions.
According to the national report, the IAEA WWER safety “Issues Book”, which was developed in1990 to establish and rank WWER NPP design and operational safety issues, was widely used. For
ChNPP, which is under decommissioning, the document “Basic Regulatory Requirements and5

Estimated Characteristics of Earthquakes for Chornobyl NPP Site” was developed and approved in
2005. It was also clarified that the IAEA safety standards were widely used for the latest re-assessmentof the seismic hazard of the NPP sites.
During the country visit sufficient information was provided about the regulatory basis for safetyassessment and regulatory oversight (regulations in-force in Ukraine, which establishes requirements
for safety assessment of NPP units with respect to earthquake and extreme weather conditions indesign stage). Regulatory requirements contain detailed provisions on how to conduct safety analysis.
The safety analysis should be performed with use both the deterministic and probabilistic approaches.
2.1.1.2 Derivation of DBE
The original seismic design basis of operating Ukrainian NPPs is, as follows:
Design earthquake (DE, analogous to DBE): Intensity 5 on the MSK-64 seismic scale with exceedance
probability of 1x10-2 and peak ground acceleration (PGA) =0.025g;
Maximum calculated earthquake (MCE): Intensity 6 on the MSK-64 with exceedance probability of
1x 10-4 and PGA=0.05g.
Original Seismic Hazard Assessment (SHA) for each NPP site was performed at the design stage, i.e.
at the end of the 1970s and beginning of 80s.
It was stated that during the period from 1999 to 2010 a re-assessment of the seismic hazard of the
Ukrainian NPPs was performed taking into account recommendations of the IAEA safety standards inforce at that time. The latest IAEA safety standards (e.g. SSG-9, NS-G-3.3) were used for reassessment of the seismic hazard of SUNPP site performed in 2009-2010.
Additional seismic investigations completed on sites (ongoing for the ZNPP site) confirmed the initialdesign basis seismicity of the Rivne and Khmelnitsky NPPs (2000-2002) and determined the new
PGA (0.093 g) of the SUNPP (2009-2010). This new PGA value is based on extrapolation frommeasured plant responses to minor past earthquakes, and corresponds to the maximum expected value.
During SHA works on detailed seismic zoning and seismic micro zoning were performed. The SHA
included data describing seismic sources. Capable faulting was also considered during the SHA.
In the framework of technical assessment and long-term operation measures for SUNPP unit 1 (V302), seismic resistance is confirmed by a set of calculations for:− the primary coolant piping and pressurizer surge line for seismic impact with PGA = 0,1g using
FRS from regulation PNAE G-7-002-86;− reactor and its components, the steam and feedwater lines for seismic impact with PGA = 0,15g
using FRS from regulation PNAE G-7-002-86;− reactor containment and other seismic category I structures for seismic impact with PGA = 0,1g;− seismic qualification for all safety-related equipment for the level of PGA=0,12g using FRS,
which are based on results of instrumental seismological and geological investigations of SUNPP
site and internationally accepted methodological approach (e.g IAEA SSG-9, NRC Standards),
should be finished in 2012. All non-qualified equipment should be upgraded or replaced byqualified one.
− Basic compensatory measures are planned to be performed during scheduled outage in 2012.
In seismic Probabilistic Safety Analysis (PSA), it is planned to determine the PGA at which buildings,
structures, equipment and piping retain their function. The range of ground acceleration that will beconsidered in seismic PSA is 0.1-0.3 g.
For ChNPP the initial design basis for the plant was, as follows:− DE: Intensity 5 (MSK-64 scale);− MCE: Intensity of 6 (MSK-64 scale).
The revised estimated earthquake characteristics of ChNPP are based on instrumental surveys andanalytical studies performed during 2004-2005. The revised design basis characteristics for the SFPs
of the units and for the ISF-1 are, as follows:− DE: Intensity 5 (MSK-64) and PGA=0.05g;− MCE: Intensity 6 (MSK-64) and PGA=0.1g.

6

2.1.1.3

Main requirements applied to this specific area

During the Topical Review it was clarified that according to the regulatory requirements therecurrence frequency of the originally postulated DE (SL-1, OBE) is 1 in 100 years and the recurrence
frequency of the MCE (SL-2, SSE) is 1 in 10,000 years.
In the national report it is mentioned that according to national regulations, civil NPP structures andbuildings are classified into 3 categories (I, II, III) depending on their safety significance. Category I
buildings are required to withstand a series of extreme hazards such as MCE. The national reportclaims that seismic resistance of Structure, System and Component (SSC) was assessed in accordancewith their seismic categorization. SSCs of seismic Category I are designed to withstand MCE andmust perform their functions to ensure plant safety during and after MCE. SSCs assigned to seismic
category II are designed to withstand DE impact.
2.1.1.4

Technical background for requirement, safety assessment and regulatory oversightRe-evaluation of the seismic hazard of Ukrainian NPPs was performed using a deterministic approach.
The estimated seismic characteristics of the plant sites are based on instrumental surveys andanalytical studies. Seismic loads on equipment and its components were calculated for MCE using
accelerograms determined in calculations for equipment mounting elevations. Seismic PSAs for
operating Ukrainian power units are currently in development stage under the Comprehensive(Integrated) Safety Improvement Program.
2.1.1.5

Periodic safety reviews (PSR)

During the Topical Review phase it was clarified that the safety analysis during the NPP operation is
performed in the frame of the Safety Analysis Report (SAR) and PSR. PSR should include analysis ofinternal and external events, such as (for external events): floods, extreme wind, extreme snow,
tornado, extreme temperature, earthquake, toxic gas, explosions, and aircraft impacts. Further, thenational report mentions some other international safety assessment activities related to the topic, inparticular the safety assessment of WWER designs initiated by the IAEA in 1990. This initiative
resulted in the development of the IAEA WWER safety “Issues Book” which provided an initial basis
for formulating the safety improvement program for the Ukrainian NPPs. Another independent safetyassessment of the Ukrainian NPPs was carried out in the framework of the common EC-IAEAUkraine project (Memorandum of Understanding on Cooperation in the Field of Energy between theEuropean Union and Ukraine).
During the country visit, it was clarified that the licensee shall perform PSRs at least each 10 years or
upon regulatory request. The scope of the PSR is based on IAEA standard NS-G-2.10 (14 safety
factors). It is noted that this includes revalidation of the design basis for external events.
2.1.1.6

Conclusions on adequacy of design basis

The initial seismic design basis applied to the Ukrainian NPPs (PGA=0.05g) is lower than the current
recommendation of the IAEA (minimum PGA=0.10g). Taking into account IAEA recommendations
and conservative approach, design level of PGA was increased to 0.1g for KhNPP, RNPP and ZNPP
and to 0.12g for SUNPP (30% conservative margin to PGA=0.093g was assumed). Thus, the currently
accepted assessment level is MCE = RLE = SL-2 = 0.1g/0.12g.
2.1.1.7

Compliance of plant(s) with current requirements for design basis

The national report identifies that the plants are compliant with current design basis requirements. It
was demonstrated that the structures of category I of all NPP units (containment, reactor building,emergency diesel generators (EDG), essential service water spray ponds) and category II (including
turbine hall) are resistant to design basis seismic loading. The stress test results also confirmed that thesafety-related equipment and piping are capable of performing its main safety functions under designbasis seismic loading.
Seismic evaluation of the equipment is ongoing. In the course of the country visit, the regulator
confirmed that seismic evaluation is practically completed for KhNPP-2 and RNPP-4. The 0.1g target

7was conservatively accepted in the qualification process according to IAEA recommendations (0.12g
for the SUNPP with an additional 30% engineering margin). According to the regulator, no
mechanical equipment or piping was detected which would not have adequate safety margins, but
electrical and Instrumentation and Control (I&C) equipment is still under review. One of theconditions for the lifetime extension of NPP units (design lifetime is 30 years) is to ensure resistanceof equipment to earthquakes with at least PGA=0.1g (for SUNPP – 0.12g) of safety-relevant SSCs.
The national report indicates that structures and components of the spent fuel pools at Ukrainian NPPs
are robust against design basis seismic impacts. The structures and components of the Dry Spent Fuel
Storage Facility (DSF) of the ZNPP are designed to withstand seismic impact with 0.2g groundacceleration.
Compliance of safety-related SSCs with current requirements for design basis was checked via
technical inspections, testing, examinations, maintenance, and regular monitoring. For ChNPP studies
conducted for units 1 and 2 and ISF-1 in 2005-2008 confirmed the structural stability of the power
units and cooling pools under earthquakes up to MCE.
It is recommended, that the regulator should consider how to ensure that the seismic re-evaluations
include the full scope of equipment for the relevant safety functions, including equipment for SBO.

2.1.2

Assessment of robustness of plants beyond the design basis

2.1.2.1

Approach used for safety margins assessment

To assess the impact of earthquakes on the main safety functions, the ranges of earthquakes leading tosevere fuel damage and to loss of containment integrity have been defined. Seismic loads with PGAs
of 0.05g, 0.1g, 0.15g, and 0.2g were analyzed in the framework of the stress tests. Based on IAEA
recommendations a target minimum value of horizontal PGA=0.1g (0.12g for SUNPP) was chosen asa Review Level Earthquake (RLE) with the purpose to assess the seismic robustness of the safety
important SSCs. Although it is not explicitly mentioned in the report, it seems that the recently chosen
RLE can be treated as a new MCE (SL-2, SSE), as confirmed during the country visit. So far, seismic
safety margins are only determined based on a deterministic approach (assuming normal design
criteria), e.g. SUNPP: for pipings and buildings holding safety relevant equipment, the range of 0.12g
to 0.3g is being analysed in order to determine the maximum critical acceleration until buildings
maintain their integrity. This approach in SUNPP is planned to be extended to all NPPs in the courseof the seismic PSA development program.
For the ChNPP, it was postulated during the stress tests that an earthquake of intensity more than 6(MSK-64), i.e. exceeding MCE, can cause a beyond design basis accident involving nuclear fueldamage. The situation was postulated as deterministic regardless of its probability.
2.1.2.2

Main results on safety margins and cliff edge effects

The following main results have been obtained with respect to the safety margins assessment:− Category I structures have safety margins (capability at least 0.1g);− Containments safety margins: capabilities of 0.185g for WWER-440 (technical assessment in theframework of Rivne-1, 2 long-term operation activities), 0.17g for WWER-1000/V-320(assessment in the framework of stress tests), 0.15g for WWER-1000/V-302, -338 (technicalassessment in the framework of South Ukraine-1 long term operation activities). Differential
design pressure of containments was considered.
− Containment structure failure has been determined as a cliff edge effect.
− Soil liquefaction was not considered during the stress test evaluations due to the assumption of
non-existence of factors for liquefaction phenomenon occurrence during predicted maximum
earthquakes at the operating NPPs.
High Confidence Low Probability of Failure (HCLPF) values for the assessed structures and systems
have to be evaluated in frame of seismic evaluation of SSC and seismic PSA or SAM analysis for each
NPP’s unit.

8The national report claims that based on the stress tests assumptions, "quite a large amount" of safetyrelated equipment and piping and safety systems have adequate safety margins up to 0.1-0.2g. The
structures and components of the spent fuel pools are said to have safety margins (0.1g). The DSF is
designed to withstand 0.2g seismic impact. The report does not provide any justification on thesufficiency of the safety margins. However, according to information received during the country visit
the results of safety margin assessments were accepted as satisfactory taking into account enoughconservative levels of RLE which were chosen for seismic re-assessment of Ukrainian NPP units bycomparison with results of sites seismic investigations.
Fuel assemblies have significant safety margins with respect to seismic loads. Russian-made TVEL
fuel retains its functions up to 1.6g in horizontal direction; 2.6g in vertical upward direction and 1.13g
in vertical downward direction. The Westinghouse fuel retains its functions under an axial impact up
to 4g and a transverse impact up to 6g.
Secondary effects of earthquakes (e.g. internal flooding due to non-seismically qualified pipe breaks)
have been included in the scope of the plant-specific Level 1-PSAs.
2.1.2.3

Strong safety features and areas for safety improvement identified in the process

According to the national report, and without giving quantitative evidence, the safety improvement
measures implemented at Ukrainian NPPs in the last 10-15 years have greatly reduced the probabilityof core damage and radioactive releases. It is stated that the analysis performed has not revealed any
new critical external natural hazards or combination of hazards additional to those already consideredin NPP design and analysed in detail in NPP SARs.
Another main statement in the national report is that equipment and piping required to perform main
safety functions are robust against design basis seismic impacts; the main reactor equipment andpiping and safety systems are said to have safety margins. Fuel assemblies are said to have evensignificant safety margins with respect to seismic loads.
As one of the few countries in Europe, automatic reactor shutdown systems in case of earthquake are
implemented at all Ukrainian NPPs.
2.1.2.4

Possible measures to increase robustness

The following measures are envisaged in the “Comprehensive (Integrated) Safety Improvement
Program for Ukrainian NPPs”:– Additional seismic investigations of NPP sites and assurance of robustness of equipment, piping,buildings and structures important to safety to seismic impact >0.1g (0.12g for SUNPP);– Complete equipment seismic qualification for 0.1g (0.12g for SUNPP);– Complete additional instrumental seismic investigations at the ZNPP site;– Implement permanent seismic monitoring systems at all Ukrainian NPPs (for 2012 at SUNPP,
2014 at KhNPP and RNPP, and 2015 at ZNPP);– Develop a seismic PSA for all Ukrainian NPPs.
The first measure mentioned above has been defined by the regulator as a mandatory condition for the
NPPs lifetime extension.
For Chornobyl a number of measures to improve ISF-1 seismic resistance were implemented in 20082011. Following the results of the stress tests, some additional studies are envisaged to assess safetymargins for structures and failure probabilities for cooling pool lining in case of earthquakes greaterthan MCE.
2.1.2.5

Measures already decided or implemented by operators and/or required for follow-up by
regulators

As identified in 2.1.2.4.

2.1.3

Peer review conclusions and recommendations specific to this area

The recently accepted design basis (MCE=RLE=0.1g/0.12g) is in compliance with the IAEA
recommendation for the minimum horizontal PGA=0.1g.

9The beyond design basis capability is described in the national report and safety margins are defined.
Evaluation of safety margins was done by using a deterministic approach. Significant margins withrespect to seismic loads were defined for the fuel assemblies and for the containment structures. Dueto the fact that the seismic evaluations for some parts of the equipment, piping, buildings andstructures important to safety are not yet completed, the national report does not provide a satisfactory
justification on the sufficiency of overall safety margins.
Despite the fact that the national report claims that robustness of main equipment and piping required
to perform the safety functions has been proven against the design basis seismic impacts, some
additional seismic safety upgrading measures are envisaged, e.g.: additional investigations for beyond
design basis seismic impacts; completion of equipment seismic qualification; replacement of nonqualified equipment; completion of the on-going studies concerning structures and piping resistances;
future implementation of permanent seismic monitoring system at all NPPs (such a system is currently
in commissioning stage at ChNPP); development of Seismic PSAs for all plants.
It is recommended, that the Ukrainian regulator should consider how to monitor in a systematic way
the implementation of the upgrading measures in order to assure timely completion as part of the
C(I)SIP. According to the information received during the country visit the upgrading measures are
already included in the regulatory inspection program.

2.2

Description of present situation of plants in country with respect to flood

2.2.1

Design Basis Flood (DBF)

2.2.1.1

Regulatory basis for safety assessment and regulatory oversight

The additional information presented during the Topical review phase explains that the requirements
for NPP safety assessments with respect to earthquake and extreme weather conditions (including
floods) are established in several national regulations already in force.
2.2.1.2

Derivation of DBF

The flooding against which the plants are designed is described in the national report. The normal
headwater level (NHL) of the cooling reservoirs or the maximum design-basis level of the rivers, aswell as the site elevation levels have been determined for all the plants.
2.2.1.3

Main requirements applied to this specific area

The requirement for the frequency/return period for the DBF is not specified in the national report.
Only for the ZNPP it is mentioned that dams of all five upstream reservoirs are designed forsnowmelt-induced flood of 0.01% occurrence. Later during the Topical review process it was clarified
that according to the regulatory requirements the recurrence frequency of the originally postulated
extreme weather conditions (including flood) is once in 10,000 years for all NPPs.
2.2.1.4

Technical background for requirement, safety assessment and regulatory oversightA deterministic approach has been applied during the safety assessment of the flooding hazard. The
risk for site flooding has been considered which can result from increasing of the water level in therespective cooling reservoirs caused by damage or failure of hydraulic structures (dams) or the highflood level of the respective river due to snowmelt or rain.
For the ZNPP, calculations have been made for the cooling pond filling and emptying when the
breaking wave travels trough the upstream Dnipro Cascade reservoirs. Input of the wind in the wave
height has also been considered.
For the ZNPP, the possibility of UHS loss as a result of hydraulic structure damage after an earthquake
has been analysed. The conclusion was drawn that a failure of the Kakhovka Hydroelectric Plant dam
after an earthquake may lead to loss of make-up of the essential service water spray ponds. During thecountry visit it was clarified that ZNPP developed the set of measures for enabling alternative watersupply to the spray pond. It was confirmed that the capacity of the spray ponds is enough to ensure
safe NPP operation during 24 h at nominal power. Additional programs to supply cooling water from10

fire hydrants have been developed, such as program for supply of cooling water to DGs from fire
hydrants; program for supply of cooling water to pumps of safety systems from fire hydrants In
addition an assessment of impacts of flood with regard to the DSF has been evaluated.
2.2.1.5

Periodic safety reviews

Based on the additional information obtained during the Topical review phase, it is clear that similar
conclusions could be made to those, presented in 2.1.1.5 above. As it has also been clarified during thecountry visit, the PSRs include flooding analysis.
2.2.1.6

Conclusions on adequacy of design basis

The national report claims that no protection against external sources of the site flooding is needed.
However, during the Topical review meeting in Luxembourg it was stated that Ukrainian NPP's sites
are situated in the areas which exclude the risk of external flooding. In this respect it should be notedthat the flooding hazard caused by extreme precipitation is evaluated in the Section 4 “Extreme
weather conditions” of the report, which is discussed below.
2.2.1.7

Compliance of plant(s) with current requirements for design basis

No satisfactory information is presented in the national report with respect to plants compliance.
Compliance of the plants with their respective current DBF has been assured by regular monitoring of
the water level of the cooling reservoirs or rivers and by inspections and maintenance of the hydraulicSSCs, including sewage systems.

2.2.2

Assessment of robustness of plants beyond the design basis

2.2.2.1

Approach used for safety margins assessment

A deterministic approach has been applied for assessment of the flooding hazard. Using statisticalhydraulic analysis, the NHL and the maximum possible level of the cooling reservoirs or rivers havebeen determined.
2.2.2.2

Main results on safety margins and cliff edge effects

The following safety margins have been defined in the national report:– ZNPP: The maximum possible level of the cooling reservoir (Kakhovka) in case of the worst
scenario of failure of the Dnipro river dams will be 19.4 m, which is lower than the levelling
elevation of the plant site (22.0 m)– KhNPP: The levelling elevation of the plant site and the cooling water reservoir dam top constitute206.0 m, while the maximum level of a flooding wave in case of dam failure is 203.0 m;– RNPP: The levelling elevation of the plant site is 188.5 m and the maximum water level in the
Styr river is 164.4 m;– SUNPP: The levelling elevation of the plant site is 104.0 m. Rise of the water level in the Yuzhny
Bug river does not pose a hazard since it is 70 m lower than the site location. The water level in
the Tashlyk reservoir may reach 101.5 m (level of a dam spill-over to Yuzhny Bug river).
– ChNPP: The levels of the plant site (113.7 – 114.0 m) are significantly higher than the extreme
high water level (111.3 m)
No cliff edge effects have been identified during the stress test evaluations.
2.2.2.3

Strong safety features and areas for safety improvement identified in the process

The national report claims that there are no direct risks of flooding, including those resulting fromfailure of hydraulic structures caused by an earthquake. This conclusion is based on the results ofsafety margins evaluation and the favourable levelling elevations of the plant sites. It is claimed that
all compartments in all NPPs with safety systems which could be affected by flooding are equippedwith automatic drainage pumps. From the country visit it is noted, that at SUNPP, in some cases thisfunction is delivered by mobile equipment.

11

2.2.2.4

Possible measures to increase robustness

The national report claims that there is no need for developing and implementing additional measures
to improve the plants robustness against potential external flooding. Only for the ZNPP were decided
some additional detailed analyses of possible loss of UHS due to dam break after an earthquake andsome additional measures against possible flooding of the reactor building have been implemented. As
a consequence of stress tests the ChNPP has planned to evaluate the resistance of outdoor service lines
to extreme impacts and, if necessary, implement appropriate measures.
2.2.2.5

Measures already decided or implemented by operators and/or required for follow-up by
regulators

As identified in 2.2.2.4.

2.2.3

Peer review conclusions and recommendations specific to this area

The flooding against which the plants are designed is defined for each plant. The approach used for theassessment of the DBF appears to be reasonable in compliance with the international standards. The
design basis for flooding seems to be adequate for the specific conditions of the plant sites locations.
The conclusion based on the results of safety margins evaluation is that there are no direct risks offlooding, including those resulting from failure of hydraulic structures caused by an earthquake.
Therefore some additional measures to improve the plants robustness against potential external
flooding were decided and implemented only for the ZNPP, which is most likely to be affected bysome negative effects of the combination of upstream dam break due to an earthquake and subsequent
flood. Concerning ChNPP, it has planned to evaluate the resistance of outdoor service lines to extreme
impacts due to flooding and, if necessary, implement appropriate measures.
During the country visit it was claimed that detailed analyses were conducted on the possible failure of
the drainage and sewage systems due to heavy rains. According to the information received, theperformed analysis of site structures and sewage systems did not reveal any components whose
flooding can cause a site emergency in case of heavy rains.

2.3

Description of present situation of plants in country with respect to extreme
weather

2.3.1

DB Extreme Weather

2.3.1.1

Regulatory basis for safety assessment and regulatory oversightThe regulatory basis for safety assessment of the operating NPPs is not provided in the national report.
As clarified during the country visit, not only for the ChNPP (under decommissioning), but for all
Ukrainian NPP sites international and national standards are used as basis (Eurocode, State
Construction Standards DBN B. 1.2-2:2006, PiN AE-5,6, etc.). Most likely the same standards wereused for the operating plants as well. According to the additional information provided during the
Topical review the requirements for NPP safety assessments with respect to earthquake and extreme
weather conditions are established in several national regulations already in force.
2.3.1.2

Derivation of extreme weather loads

The following extreme weather loads have been presented:
Extreme air temperature: for all plants absolute maximum/minimum temperatures have been
defined, ranging from -38 to +41oC for the operating plants and from -43 to +45 oC for Chornobyl.
– Extreme precipitations (rainfalls): the design flow rate of rainwater is determined on the basis of
20-min rainfall intensity. The design value varies from 85 L/secxha to 100 L/secxha. For
Chornobyl the maximum value is 72 mm for 20 min and 190 mm per day.
– Extreme snow: the characteristics have been presented only for Chornobyl: 2.1 kPa load;– Extreme wind: the characteristics have been presented in the national report only for Chornobyl:
The load for the height from the ground surface varying from 5 to 110 m is 0.656 to 1.92 kPa. In
–

12

–

–

–

–

the course of the country visit, it has been confirmed by the regulator that similar assessments
were performed for all NPPs;
Tornado: The tornado impact has been analysed considering wind frontal pressure, pressure drop
and flying missiles. The shock wave impact with frontal compression pressure has been defined as∆P=30kPa design value. In general, the plants have only been designed against the effects ofstrong winds, but not against tornados.
For Chornobyl the maximum tornado is F 3.0 class on the Fujita-Pearson scale and the design
tornado is F 1.5. The pressure drop between the tornado vortex centre and periphery for F 3.0(F 1.5) is 8.1 (3.1) kPa, the maximum vortex rotation speed is 81 (50) m/sec, and the tornado
width is 290 (50) m.
External fires: safe distance between the facility and mixed forests is determined to be at least 100
m on the leeward side (according to the wind rose at an average annual wind speed up to 10
m/sec);
Combined hazards, for example effect of extremely high air temperature and forest fires (e.g. for
RNPP and KhNPP) have been considered during the stress test assessment.

2.3.1.3

Main requirements applied to this specific area

During the Topical review phase it was explained that the requirements are contained in theregulations and standards, mentioned in paragraph 2.1.1.1 above. Regulatory requirement for therecurrence frequency of the originally postulated extreme weather conditions is once in 10 000 years.
The national report claims that according to regulatory requirements, tornado impact must be taken
into account for buildings and structures of category I responsibility for nuclear and radiation safety.
For Chornobyl, the category I structures shall be resistant to F 1.5 tornado, extreme wind, snow andtemperature.
2.3.1.4

Technical background for requirement, safety assessment and regulatory oversightA deterministic approach was used. The characteristics were established based on extrapolations ofhistorical data.
2.3.1.5

Periodic safety reviews

No particular information is presented in the national report with respect to extreme weather
conditions, considered during the PSRs. However, during the country visit it was clarified that the
PSRs are regularly performed and consider extreme weather conditions. Based on the additional
information obtained during the Topical review phase, it is clear that similar conclusions could bemade to those, presented in 2.1.1.5 above.
2.3.1.6

Conclusions on adequacy of design basis

The national report claims that the list of extreme weather conditions is sufficient, their characteristics
are established in compliance with regulatory requirements and sufficient analyses were completed.
Later during the Topical review process, some additional information has been provided claiming thatthe impact of the extreme snow and wind was considered for all Ukrainian NPP sites during stresstests. In the course of the country visit, it was clarified that such effects are not within the scope of
PSRs. Besides, possible combinations of external hazards (for example, heavy rains and lightning)were analyzed. At the same time, the report does not provide sufficient information which would
demonstrate that the analysis takes into account multi-hazards. During country visit, it was clarified
that in the SAR multi-hazards were considered. Lightning analyses, including indirect effects(electromagnetic impact), was carried out as one of the topics of SAR and PSRs for Ukrainian NPPs
(but not as an initiating event in the scope of the stress tests). During the country visit, it was
confirmed that sufficient NPP resistance against effects from lightning, including electromagnetic
fields, has been proven due to in-design protection and thus excluded from further analysis.

13

2.3.1.7

Compliance of plant(s) with current requirements for design basis

The conclusion of the national report is that the plants are in compliance with the original extreme
weather loads. Therefore, no additional measures were required to enhance the resistance of theoperating plants to extreme winds, precipitation, temperatures, external fires and their combinations.
Measures for tornado resistance of the plants shall be developed and implemented. The national reportstates that for extreme precipitation the analysis of site structures and sewage systems did not reveal
any components whose flooding can cause a site emergency in case of heavy rains.

2.3.2

Assessment of robustness of plants beyond the design basis

2.3.2.1

Approach used for safety margins assessment

A deterministic approach has been used. Safety margins were assessed by comparison of extreme
parameter values with the design basis for extreme weather loads, if available.
2.3.2.2
–

–

–

–

–

Main results on safety margins and cliff edge effects

Extremely high/low temperatures: the comparison of the maximum temperature and minimum
temperature obtained as a result of long-term observations with the design basis shows thatabsolute temperatures observed at all operating plants are not exceeded. For the WWER-1000
units engineering assessment of cooling capabilities of different heat exchangers (water-cooled or
air-cooled) has been performed in order to determine the threshold value of extreme temperatures.
Extreme precipitations: the maximum observed precipitation levels at the plant sites are lower thanthe design criteria established for the plant’s engineering structures. The capacity of the rain waterdrains and the industrial and storm sewage system is sufficient to discharge rainwater from the site
surface with the design basis precipitation intensity. Additional investigations, carried out during
stress tests, showed that for the buildings housing safety important equipment and systems, there
are no hazards caused by extreme rainfall or snowmelt.
Tornado: the frontal pressure values calculated on the basis of statistical data are in range from 6.0
to 12.0 kPa for all NPP sites and are substantially lower than shock wave impact with frontal
compression pressure ∆P = 30 kPa (design value). The pressure drop of 6.4–10.3 kPa under
tornado impacts calculated on the basis of statistical data is lower than 8.1-10.9 kPa conservatively
accepted in the SARs for such loads. Tornados that may occur in Ukraine do not pose hazards for
NPP buildings and structures in terms of flying debris.
External fires: forests adjacent to NPPs (if pertinent) are considered the main potential source of
external fire. For all the plants the actual distance from the plant units to the forest exceeds thedesign safety limit of 100 m from a leeward side.
No cliff edge effects have been identified.

2.3.2.3

Strong safety features and areas for safety improvement identified in the process

One area for safety improvements identified in the process is the need to increase NPP robustness
against tornados (in terms of potential loss of essential service water). Tornado strikes on operating
NPPs can potentially result in a failure of spray ponds of the essential service water system (ESWS)
due to its impact on the open water surface. Loss of ESWS can cause failure of emergency power
supply (EPS) from EDG.
For other extreme weather conditions analysed in the national report, the report's conclusion is that no
critical external hazards and no combinations of hazards other than the ones already incorporated in
the plant designs and analysed in SARs have been identified.
2.3.2.4

Possible measures to increase robustness

The following measures have been defined in the national report as a result of the stress tests:
Assurance of operability of essential service water consumers under loss of water in spray pondsof operating plants as a result of tornado.

–

14

–
–

Resistance analysis of the ChNPP category I structures against possible failures of structures upon
F 3.0 tornado.
Analysis of durability and probable failure of ventilation stack-1 of the ChNPP under seismic
impact and tornadoes.

2.3.2.5

Measures already decided or implemented by operators and/or required for follow-up by
regulators

As identified in 2.3.2.4.

2.3.3

Peer review conclusions and recommendations specific to this area

A deterministic approach has been applied for assessment of the hazard of the extreme weather events.
The design basis for extreme weather seems to be adequate for the specific conditions of the plant sites
locations.
The beyond design basis capability is described and discussed in the national report and the safetymargins are defined. Safety margins were assessed by the comparison of extreme values of theparameters with the design basis for the extreme weather loads, when they are available. The national
report states that a special attention should be paid for defining vulnerability of the plant in case of
beyond design basis tornado (in terms of potential loss of essential service water). Safety margins withrespect to extreme wind and extreme snow should be evaluated too.
It is recommended that the Ukrainian regulator should consider monitoring the fulfilment of additional
analyses of the threat to the ESWS due to the tornado impact as well as the evaluation of emergency
arrangements with respect to the personnel access to sites in severe weather conditions.

3
3.1
3.1.1

PLANT(S)ASSESSMENT
RELATIVE
TO
LOSS
OF
ELECTRICAL POWER AND LOSS OF ULTIMATE HEAT SINK
Description of present situation of plants in country
Regulatory basis for safety assessment and regulatory oversightThe regulator stated in the report that a comprehensive regulatory system is in place for nuclear safety
and areas of radiation safety within its responsibility. Further, it is stated that there is also acomprehensive legal infrastructure that addresses IAEA requirements and all relevant international
conventions in force. Generic requirements for NPPs in the Ukraine are comprised in the “Generalprovisions on NPP’s safety, NP 306.2.141-2008” and “Nuclear Safety Rules for NPPs withpressurized water reactors, NP 306.2.145-2008”.
Each power plant unit has a SAR. The safety analysis methodology combines complementary
deterministic and probabilistic methods (“Requirements for NPP’s safety assessment, NP 306.2.1622010”). The SAR structure and contents are determined in the documents RD-95 and KND-306(endorsed by Regulatory Authority). The SAR consists of the Integrated Safety Analysis Report andmandatory appendixes such as Technical Safety Substantiation (TSS), Additional Materials on Safety
Analysis (AMSA), analysis of Design Basis Accidents (DBA), analysis of Beyond Design Basis
Accidents (BDBA), and PSA.

3.1.2

Main requirement applied to this specific area

The requirements on the plant electrical systems are included in General provisions on construction
and operation of the EPS systems of nuclear power plants PNAE G-9-026-90. These requirements
result in robust electrical systems, which typically include three or more outside power supply lines; 3
redundant trains of electric power supplied by 3 independent EDGs per reactor (3x100% capacity).
Each reactor has 3 trains of DC-UPS secured with station batteries of at least 1 hour capacity, as aminimum. In case of LOOP, SUNPP and ZNPP sites can be supplied from nearby thermal or hydropower plants.

15

The requirements for the design of the emergency power facilities with DG are specified in the PNAE
G-9-027-90 “Rules of designing of the emergency power supply systems of nuclear power plants”.
General requirements for the storage of auxiliary and operating materials are also specified in NP
306.2.141-2008 “General provisions on NPP’s safety”.
The primary heat sink is ensured by three trains of essential service water system, which uses large
spray cooling ponds, special cooling towers, as well as rivers and large water reservoirs.
The following national standards are applicable: PNAE G-7-008-89 “Rules of construction and safe
operation of the equipments and pipelines of nuclear energy facilities”, and PNAE G-5-020-90 “Rulesof designing and operation of emergency core cooling and heat removal from a nuclear reactor toultimate heat sink systems”. Besides that, the seismic qualification structures, systems and components
important to safety are contained in PNAE G-5-006-87 “Standards for design of earthquake-resistant
NPPs”. The Ukrainian representatives reported during the peer review discussion that all specificregulations related to EPS, LUHS, resistant against external events are currently under review.

3.1.3

Technical background for requirement, safety assessment and regulatory
oversight

The report states that the basis for the licensing is a deterministic approach. Specific reactor physics
and thermo-hydraulics calculations have been performed using validated and verified models with
RELAP, DYN3D and other computer codes. A PSA is mandatory part of the SAR. In compliance withthe regulatory requirements, a full-scope PSA shall be developed as part of the SAR to account forinternal initiating events, internal and external hazards (fire, flooding, etc.) for all operational states(nominal and low power, shutdown). The scope of developed PSA studies for all operating NPPs
(nominal power) presented in the report, a level 2 PSA for low power and shutdown was developed for
Zaporizhzhya-5. There are plans to extend PSA level-2 studies for all NPPs to address all potential
internal and external hazards for the core and spent fuel pool in all operating modes, as well as
development of seismic PSAs.

3.1.4

Periodic safety reviews

The report states that the NPP’s safety is subject to review every 10 years, as well as on demand of theregulator (in the light of the operational experience, new safety significant information, due to changes
in legislative or regulatory requirements, etc.) including the sections on radioactive waste management.
The last PSR was performed in 2010 for Rivne-1, 2, and a PSR is currently on going for South
Ukraine Unit 1 (to be completed in December 2012). PSR is scheduled for other NPPs between 2014
and 2019 or before the end of their design lifetime.

3.1.5

Compliance of plants with current requirements

The report states that all plants are in compliance with current requirements.

3.2
3.2.1

Assessment of robustness of plants
Approach used for safety margins assessment

In assessing the safety margins with respect to the LOOP and loss of UHS a deterministic approach
was used. It is claimed that all situations required by the Stress Tests specifications were analyzed:−
Reactor Units
The time periods to fuel damage were calculated for the following cases (various operation modes ofoperating reactors):− LOOP supply and loss of Emergency diesel-generators;− LOOP supply, EDG and Additional DG;
Loss of UHS, in combination with SBO (i.e. loss of off-site and EPS to the site).
−
Fuel Pools
Threshold values were calculated for the following cases:– Spent fuel pools at Zaporizhzhya, Khmelnitsky, Rivne and South Ukraine NPPs.

16

Dry spent nuclear fuel storage facility at ZNPP.
Spent nuclear fuel stored at Chornobyl units 1&2 spent fuel pools and ISF-1. The spent fuel poolof unit 3 that may be used to store spent nuclear fuel (as a standby facility) was also analyzed.
The coping times for LOOP, SBO and LUHS without any external support have been calculated
analytically in terms of time periods to fuel damage, for different operation modes of the reactors. The
threshold values were calculated for Spent Fuel Pool (SFP) and Interim SFS Facility as well.
−
Loss of off-site power (LOOP)
A design solution for LOOP is to transfer the plant to the house load operation. If it is not possible, theplant normal and safety buses are powered from the EDGs and batteries. Each train of the EPS system
is capable of ensuring safe shutdown state in all design basis accidents. In case of LOOP, signals forstartup of the DGs are actuated independently for each EDG. All EDGs are provided with 7-day
reserve of diesel fuel, and EDG design-basis continuous operation in LOOP is 250 hours.
Consequently, it may be concluded that the emergency power supply system was designed using theredundancy principle; each unit has 3 EDGs, which is sufficient. In addition, all NPPs are equippedwith two common-unit additional DGs. The power of each common-unit DG (5600 kW) was selected
to ensure power supply to all main equipment of two units, taking into account failure of one of the
DGs. At each site there are two common unit DGs seismically qualified, and installed in separatebuildings. It was clarified during the country visit, that at this moment common unit DGs are notconnected to all units on the SUNPP site. There are plans to make common unit DGs available for allunits on-site.
As an alternative power supply option, South Ukraine and Zaporizhzhya plant sites can be supplied
from nearby thermal or hydro power plants. Khmelnitsky plant may try to power safety systems fromalternative sources such as the power unit remaining operational or from the grid through 330/750 kV
outdoor switchyard via the 330 kV high-voltage line (Shepetovka, Rivne or Khmelnitsky substation)or via 750 kV high-voltage line. Rivne plant may try to power safety systems from alternative sourcesof four 330 kV high-voltage lines (Rivne, Grabov, Kovel or Lutsk Sev substations) or via 750 kV
high-voltage line (Zapadnoukrainskaya substation).
A series of measures to increase reliability of power supply to safety systems are ongoing under the
C(I)SIP. This includes modifications to allow supplying the safety systems of an affected unit from theneighboring units of the same site.
Station Blackout (SBO)
The discharge time of the station batteries in the emergency power system is designed such that theloads can be supplied by the batteries alone for about 1 hour in the original design. The country
representatives confirmed during the country visit that in the units, where I&C systems and batteries
have been modernized, the real depletion time is about 8 hours. Modernization for units with 1 hour
discharge time is foreseen in the framework of C(I)SIP.
In the SBO situation, the operators may initiate a makeup to steam generator (SG) from turbine halldeaerator tanks (by gravity) and primary system makeup from Emergency Core Cooling System(ECCS) hydro accumulators (pressure and gravity driven feed). This allows extending time before thecore damage (more than for 12 hours). However, these actions after discharging the batteries are rather
limited and require mobile energy sources to ensure monitoring the necessary parameters and ensuring
the minimum control of the associated line up valves.
It is noted that initializing and maintaining feed & bleed procedures require at least a minimal
electricity power supply, which after depletion of the station batteries will not be available. With thisregards, there are plans to install a mobile diesel generator (MDG) with low power output of 200 kW,
which will serve to recharge the station battery and thus ensure monitoring of the plant vital
parameters, certain control functions, and emergency lighting.
A design solution for this situation is currently implemented only at WWER-440 reactors (Rivne NPP)and consists of the seismically qualified additional emergency feedwater system (AEFS). Pumps thatare used, e.g. for secondary feed & bleed operation mode, are diesel driven, air-cooled and therefore
these are independent of the electric power supply. AEFS has 2x1000 m3 of water resource; the diesel
fuel reserve ensuring 72 hours of autonomous operation. Time required to put AEFS into operation (i.e.
start SG feeding) is no more than 30 minutes.
––

17

However in WWER-1000 units, in order to increase current level of plant protection against naturaland man-made external hazards, which may result in SBO conditions, there are currently available
mobile diesel generator and pumping units (MDGPU) that ensures the emergency makeup of SGs.
Mobile pumping units are diesel driven fire pumps/trucks (PNS-110, 1 truck at ZNPP, RNPP, KhNPP
and 3 at SUNPP), with flow rate of 110 l/s and pump head of 0.9 MPa, which can take water fromvarious resources such as Emergency Feedwater System (EFWS) tanks, demineralized water tanks, aswell as any water sources within the 200 m area (inlet channels, cooling ponds, tanks, etc.), or regularfire trucks (ATs-40/4) with flow rate of 40 l/s and pump head of 0.9 MPa. There are 16 units at ZNPP,
9 at SUNPP, 8 at RNPP and 9 at KhNPP. The overall time of autonomous operation, during which
PNS-110 can ensure operation is limited by the fuel tank capacity, and is 8 hours. If the diesel fueltank is continuously re-filled, the PNS-110 can operate indefinitely. In some units necessaryconnections (pipes, branches, valves) to connect MDGPUs are available, and also procedures forconnection are ready. The utility reported that further improvements of the procedures are foreseen.
During the country visit it was clarified that the PNS-110 fire trucks are actually operated by the firebrigades, which are under the supervision of another ministry. The utility informed the country review
team that it has been decided to purchase new mobile pumps, to be independent from the fire brigades.
Future action to increase robustness of the diesel driven pumping capacity will include delivery ofmobile pumps that will be stored in a distance 3-4 km from the plant site and that will be qualified tothe external hazards anticipated for the site. Besides that a simultaneous feeding of SG for several
units at one site (multiple unit sites) showed necessity for additional mobile pumping units. In order toensure a primary circuit make-up via ECCS pumps, there are plans to provide a larger MDG of acontainer type, qualified to anticipated external hazards, which will provide power output of 2,5 3 MW to 6kV, among others for low pressure core injection pump and EFWS pump. Corresponding
measures are under consideration and will be decided and implemented in the frame of the Upgrade
Package C(I)SIP.
−
Loss of ultimate heat sink
The UHS at WWER-440 and WWER-1000 units is provided via the essential service water system(ESWS). If it is unavailable, the secondary feed and bleed via SG may be initiated. However during
shutdown states, the secondary feed & bleed is less effective and requires lot of feedwater reserves.
Design features related to prevention of loss of essential service water system include a three-train
design, each with 100% cooling capacity calculated for DBA, and large cooling ponds.
Depending on the accident progression, the following water sources can be used to feed the primaryand secondary circuits and spent fuel pools (however, the evaluation of the availability andapplicability of these sources for primary circuit and SFP is not provided):– primary purification system and water treatment facility water storage tanks;– distillate, boron concentrate and borated water tanks;– water inventory in cooling towers of the service water supply system at WWER-1000/V-302/338;– water of the fire extinguishing system;– spray ponds of group A (reactor hall) of the service water supply system;– artesian wells.
A water delivery to refill various tanks, or injection to SG depends on availability of the respective
pumping means, e.g. stand-by pumping devices if electricity is available, and / or mobile devices if
electricity is unavailable.
−
Loss of ultimate heat sink with SBO
The following scenarios were analyzed during the stress tests for which safety margins were calculated(not all below listed scenarios are technically feasible at this moment, some of them require equipment
and modification which have not been decided yet):
Reactor operation at rated power:
basic scenario “total station blackout and loss of heat removal to the UHS” (taking into accountoperation of first category non-interruptible power supply equipment and capacity of batteries,
operator actions according to EOP);– total SBO and loss of heat removal to the UHS with secondary “feed and bleed” procedure using a
low-head MDGPU;

18

total SBO and loss of heat removal to the UHS with primary “feed and bleed” procedure using
MDGPU;– total SBO and loss of heat removal to the UHS with pressurizer safety relief valve (RV) stuck
open (medium size Loss of Coolant Accident (LOCA));– Total SBO and loss of heat removal to the UHS with pressurizer safety RV stuck open andprimary “feed and bleed” procedure using MDGPU (pressurizer safety RV stuck open was
assumed conservatively to cover the possible primary leaks, including leaks through MCP seals).
For shut down states:– SBO and loss of heat removal to the UHS, in case when reactor is open;– SBO and loss of heat removal to the UHS, taking into account measures to prevent reactor coredamage.
Spent fuel pool:– SBO and loss of decay heat removal from SFP to the UHS;– SBO and loss of decay heat removal from SFP to the UHS, taking into account measures toprevent fuel damage.
The heat removal under the SBO conditions is currently ensured by feed and bleed of SG through
AEFS and MDGPU. The primary circuit emergency makeup can only be accomplished by a lowpressure core injection pump that requires a MDG with sufficient power output (at least 800 kW) at
6kV voltage level, which is under consideration.
–

3.2.2

Main results on safety margins and cliff edge effects

It is claimed that the plants are sufficiently protected against LOOP. After LOOP units can betransferred into the safe state and decay heat removal can be ensured for more than 72 hours.
It is claimed that a minimum time available to reactor core damage following SBO and loss of heatremoval to the UHS without operator actions has been established, as follows:
For power operation before the initiating event:– 3.5 - 4 hours for WWER-1000– 10 hours for WWER-440/V-213 (without considering AEFS)
For reactor shut down before the initiating event, reactor opened:– 8-10 hours for all reactor designs
The time available to fuel heat up at SFP above the design limits:– 6.5 - 7.5 hours for WWER-1000– 16 hours for WWER-440/V-213.
It was noted that the time of 7.5 hours for the SFP has been calculated rather conservatively, i.e. allreactor core off loaded after 72 hours to just one section of the SFP, estimated 8 MWth residual heat,and thermal contribution from the exothermic water-zirconium chemical reaction after the fuel top
section becomes uncovered.
The report describes in Section 5.2.4 cliff edge effects for SBO and loss of UHS for shutdown reactor
states, as follows:1.
Power states for WWER-1000/V-320 reactors:–
1 hour, conservatively estimated time for discharge of batteries (8 hours for units withmodernized I&C and DC system);–
9 hours time to decrease the coolant level in the reactor below the hot legs when secondary
makeup becomes inefficient due to loss of natural circulation;–
16.5 hours, the latest possibility for the operator to intervene before irreversible heat up of thereactor core starts and leads to severe core damage.
2.
Power states for WWER-440/V-213 reactors:–
1 hour, conservatively estimated time for discharge of batteries;–
7.5 hours time to decrease the coolant level in the reactor below the hot legs (analysis withconservative approach without taking credit for operator actions and operation of AEFS);–
9 hours (analysis with a conservative approach without taking credit for operator actions andoperation of AEFS), the latest possibility for the operator to intervene before irreversible heat
up of the reactor core starts and leads to severe core damage.

19–8-10 hours, when the opened reactor and the operator should start actions to discharge hydroaccumulators. However it is noted that detailed information has not been presented in thereport, as well as whether this timing is applicable to all reactor designs.
3.
For the SFPs of Ukrainian NPPs:–
6.5-16 hours to fuel heat up above the design limits established for the most unfavorable
conditions, with the reactor core unloaded to SFP.
WWER units have large water reserves at primary and secondary circuits and relatively low core
power density, therefore the coping time is relatively long to commence the preventive or mitigative
measures to prevent core damage. However, a design solution for SBO and loss of UHS (both primary
and alternate) can be accomplished when the primary or the secondary emergency makeup is ensured,as well as recharging the batteries is ensured. The SFP cooling (fuel coverage) can be ensured by adiesel driven pump that will be able to provide makeup of about 6 kg/sec for WWER-1000, and 3
kg/sec for WWER-440.

3.2.3

Strong safety features and areas for safety improvement identified in the process

Safety margins and cliff edge effects are said to have been calculated conservatively for SBO and lossof UHS, showing that there is "relatively enough time" (7-10 hours) until the degraded conditions
occurs at WWER-440 and WWER-1000 reactors.

3.2.4

Possible measures to increase robustness

The corrective measures as well as equipment are planned or their implementation is under preparation,
but not fully implemented yet. Envisaged possible accident management measures are reported in caseof SBO situation so that to provide EPS and primary and secondary makeup within a long-term period.
The analyses of SBO and loss of the UHS with operator actions for Ukrainian WWER-1000
demonstrated that core damage can be avoided in case of SG makeup using existing mobile
equipments. This strategy can be implemented even at the late stage of accident management. Taking
into account multiple units accidents purchase of additional mobile water sources was decided. Similar
makeup requirements are determined for SFP as the outcome of the stress tests.
The primary “feed and bleed” and primary system makeup with boric acid solution to ensure coresubcriticality when depressurizing the reactor coolant system (RCS) would require a powerful MDG
capable of powering the emergency primary makeup and boron injection pumps (6kV, at least 800kW).
For that purpose existing tanks will be used. The technical specification for these MDGs is underdevelopment by Licensee. The other technical changes are under consideration; the time schedule is
not decided yet.
In order to ensure the long term make-up of SGs beyond the autonomy of AEFS, a calculation analysisof the total SBO and loss of UHS with operator actions for RNPP-1, 2 (WWER-440) demonstrated
that core damage can be avoided in case of makeup of one SG using MDGPU with the flow rate of atleast 4 kg/sec at pressure of 4 bar. This flow rate is sufficient for continuous decay heat removal. The
licensee has a plan to ensure the long-term (>72 h) makeup of the SGs and SFP with the MGPU.
The primary “feed and bleed” procedure and supply of boric acid solution using MDGPU with theflow rate of at least 4 kg/sec with pump head of 25 bar can be a possible way of emergency makeup
and cooling for WWER-440 primary circuit. A new MDG could be used to power I&C to ensure
monitoring of certain important plant parameters during the course of the event. The exact technicalspecification is under development. The storage of boric acid solution for primary system makeup or
its delivery and treatment on the NPP site with a required frequency shall be analyzed additionally to
select the best option. It is recommended that the regulator considers monitoring resolution of this
proposal.

3.2.5

Measures already decided or implemented by operators and/or required forfollow-up by regulators

The country representatives reported that a number of measures to increase robustness of the operating
NPP are already in place, or are being planned. For the reactors in service, licensee considers

20

following measures to increase the plant robustness against loss of power scenarios to prevent cliffedge effects:–
Increase the discharge time of batteries;–
Improve the emergency makeup to SG;−
Water injection into SG from fire trucks;−
Restoration of power supply to stationary makeup pumps from a MDG;−
Water injection into SG from MDGPU;−
Water injection into SG from available stationary pumps of different systems, which canpotentially be used, such as fire suppression system;–
Improve emergency makeup of the primary circuit;−
Borated water injection into the primary circuit from MDGPU;−
Restoration of power supply to stationary makeup pumps from a MDG;–
Improve SFP makeup and cooldown;−
Restoration of power supply to regular SFP makeup and cooling pumps;−
Water injection into the SFP from independent MDGPU or from the fire extinguishing system;−
Possibility of SFP passive heat removal.

3.3

Peer review conclusions and recommendations specific to this area

According to the information provided, there seems to be redundancy and diversity in the electric andcooling capabilities at all operating reactor designs to ensure the safety functions. Besides that there
are plans to further increase system robustness to cope with SBO and loss of UHS.
There is a substantial benefit from the implementation of I&C and DC modernization proposal, which
increases the discharge time of batteries. It was confirmed during the country visit that this is includedin C(I)SIP, and it is recommended that the national regulator should ensure that it is provided onschedule.
Ukraine is investigating to improve makeup possibilities to primary circuit, to the SGs, and to thespent fuel ponds. The deployment of MDGPUs has to be further analyzed in detail. It is recommended,that the regulator considers monitoring resolution of this proposal.
The above mentioned items seem to be appropriate remedial actions.

4
4.1
4.1.1

PLANT(S) ASSESSMENT RELATIVE TO SEVERE ACCIDENTMANAGEMENT
Description of present situation of plants in Country
Regulatory basis for safety assessment and regulatory oversight

The following regulatory texts constitute the main references applicable for the accident management
topics.
− General provisions on NPP’s safety (NP 306.2.141-2008) (e.g. includes request for SAMG
implementation),− Nuclear Safety Rules for NPPs with pressurized water reactors (NP 306.2.145- 2008),− NPP’s safety assessment (NP 306.2.162-2010),− Requirements on internal and external crisis centers (NP-306.2.02/3.077-2003),− General requirements for long-term operation of NPP based on PSR results (NP 306.2.099-2004),− Requirement on Content and Structure of the SAR (RD-95, KND-306).
This is complimented by utility standards which are approved by the safety authority:− a program for severe accident analyses and Severe Accident (Management) Guidelines (SAMG)
development,− requirements on structure/content of PSR-report for operating NPPs (SOY-N-YAEK 1.004:2007).

21

4.1.2Main requirements applied to this specific area

Existing regulations prescribe development of symptom based EOP for power and shutdown reactors
states for all NPPs; L1 PSA (internal and external initiating events for power state of reactor, internal
events for shutdown reactor states); L2 PSA (internal events, power and shutdown states of reactor);and SAMGs for all NPPs.
Ukraine applied PSR content as defined by IAEA with 14 safety factors. Severe accident deterministic
and probabilistic analyses are incorporated in safety factor N° 5 and 6. Safety factor N°13 (emergency
crisis management) is already included.
In Ukraine, the safety approach has been rebuilt based on IAEA guidance after the separation from
Soviet Union. The IAEA guides are used by the utility and the safety authority to established nationalprescriptive standards.

4.1.3

Technical background for requirement, safety assessment and regulatory
oversight

The report states that the operating organization is required to justify the safety of a NPP in acomprehensive manner and present the results in a SAR. The safety analysis methodology combinescomplementary deterministic and probabilistic methods, PSA being mandatory part of the SAR. PSA
results are used to:−demonstrate that safety criteria are within the limits for core damage frequency (CDF) andlarge early release frequency;−
identify and analyze risk contributors and safety issues;−
identify and analyze the key phenomena emerging in severe accidents;−
improve EOP and training programs;−
identify NPP safety issues, evaluate the effectiveness and adequacy of compensatory measures.
During the country visit, the Ukrainian representatives explained that PSA includes operating
feedback on equipment failure, simulator training experience for human risk assessment. Living PSA
is an on-going project of the utility with the objective to have one up-to-date PSA model for each unit
on each site.
It is clear from the report that Ukraine has gained technical knowledge on SA phenomenology thatwill allow the development of a SA management strategy for the operating plants. However, SAMGs
and hardware provisions for NPPs in Ukraine are not yet implemented.
Full power L2-PSAs were developed for ZNPP-5, KNPP-2, RNPP-4, RNPP-1, SUNPP-1, and havenow been adapted for all other plants. Low-power PSA has been developed and approved for ZNPP-5
and SUNPP-1 and 2, for other units work is on-going.
Chernobyl site: the report provides information on the consequences of a loss of cooling in the SFS
pond. Accident management is helped in this situation by the long time period of time before boilingdue to the low decay heat from the spent fuel. Thus, the development of a full scope PSA seems lessrelevant for Chornobyl.

4.1.4

Periodic safety reviews (regularly and/or recently reviewed)

As the PSR process was not asked for in the ENSREG specifications, it is not discussed in the national
report (single reference provided in § 4.1) but the situation has been clarified during the country visit.
The planning of future PSRs for all NPPs has been presented during the country visit. One to two NPPPSRs are now submitted to State Nuclear Regulatory Inspectorate of Ukraine (SNRIU) each year.
SNRIU and its Technical Support Organization State Scientific and Technical Center (TSO
SSTC) have to assign adequate resources for the review.
Ukraine has developed plant safety upgrade programmes which include specific deadlines. These
programmes are periodically revised (1998 (new units), 2002 (old units), 2005, 2010 and postFukushima accident). These programmes, now regrouped under C(I)SIP is the major tool in Ukraine to
specify future plants upgrades and associated deadlines.
Additional plants upgrades that may come from PSRs are added to this programme.

224.1.5Compliance of plants with current requirements (national requirements,
WENRA Reference Levels)

An earlier review of compliance with IAEA NS-R-1 ‘Safety of NPP: design’ concluded that Ukrainian
NPPs fulfilled 172 of 194 NS-R-1 requirements. Non full compliance was noted for: equipment
qualification, consideration of SA, NPP seismic resistance, completeness of probabilistic anddeterministic safety analysis and post-accident monitoring. Resolution of these non full compliances ison-going for all NPPs. SAMG and EOP for shutdown reactor states are not yet implemented on
Ukrainian NPP. In addition, most WENRA reference levels related to SAM are not yet implementedin Ukrainian NPPs.
20 years life extension for WWER440s in Rivne was authorized in 2010 but the compliance of these
NPPs with the regulator's current requirements associated to Long Term Operation (LTO) was notaddressed in the national report. This topic has been clarified during the country visit: the Rivne unit 1
and 2 PSR before LTO decision included the 14 safety factors as recommended in IAEA guidance but
a special attention was paid to assessment of irreplaceable components, taking into account existing
and/or expected degradation caused by ageing. An ageing management programme is now on-going tokeep the degradation of safety-important systems and components within acceptable limits and to takenecessary actions to maintain their in-service operability and reliability.
SAMG was not included in this PSR for LTO but was identified for further improvement. The
programme has now been accelerated (SAMG in 2012, seismic qualification of buildings, structure in2013 and so on). It can be noted here that improvements for accident prevention have been
implemented (in particular SG additional feedwater system).

4.2

Assessment of robustness of plants

4.2.1

Adequacy of present organizations, operational and design provisions

4.2.1.1

Organization and arrangements of the licensee to manage accidents

The utility Emergency Preparedness and Response System includes emergency plans for local andnational level (NNEGC Energoatom emergency plan).
The main on-site organizational features for operated NPPs include:− a plant shift supervisor, head of the shift operating personnel and responsible of the plant safety,− for each unit, a unit shift supervisor responsible of the management of MCR personnel and the
NPP unit management in accordance with the technical specification and procedures; andoperating personnel.
The licensee on-site available structures and equipment include:− Main Coolant Pump (MCR) and Emergency Control Room (ECR);− Bunkered on-site crisis centers designed as “Civil defense protective structures”; these crisis
centers includes features for protection of against contamination (high efficiency air intake
filtration, oxygen supply and were designed for defense purpose. DBE and maximum calculated
earthquake of category III buildings and structures, to which crisis centers are referred, correspondto seismicity of NPP location territory and constitute intensity 5 and 6 respectively;− Off-site bunkered crisis centers (within the 30 km zone) that should be used if the on-site crisis
center is inhabitable;− Systems and means of announcement and communication; systems to transfer plant andenvironment data to the NPP crisis centers (new system shown during the country visit in SouthUA site), emergency set of measuring devices and equipment, individual protective means,decontamination and sanitary treatment means, tools and devices, special equipment, transport andother emergency;− Mobile equipments (fire trucks) to make-up water to SG are provided by state fire fighters
brigades (example of South Ukraine during the country visit with three fire trucks able to provide
water (110 l/h) through 2 km long hoses). It seems from the country visit that the time needed to
install this mobile equipment could be several hours, especially taking into account degradedconditions.

23

At national level, Energoatom can mobilize− personnel within other NPPs;− a NNEGC crisis center;− an Emergency Technical Center (ETC) (220 persons): a unit specialized in liquidation of accident
consequences at nuclear facilities, including vehicle accidents during transportation of radioactive
materials. The unit has trained personnel and special equipment for performance of various
complexity activities in radiation hazardous conditions, using modern technologies and methods;− AtomRemontService (ARS) (195 persons) which is adequately staffed and equipped to perform
emergency-restoration and repair activities using special NPP equipment.
Energoatom can also rely on other State resources from Ukraine.
The national report stated that it is planned to reinforce the NPP equipments for emergency
management in the case of an event like in Fukushima-1.
In the framework of C(I)SIP, measures to improve habitability of MCR and ECR of RNPP units 1, 2
are under implementation. Habitability support system of MCR-1, ECR-1 has been put into trial
operation at RNPP-1: air supply ventilation systems to MCR-1, ECR-1 with air purification by iodine
and aerosol filters. The system is in operation under emergency situations (including loss of power)
related to external air equivalent dose rate increase above established value for free access premises.
Scheduled term of the measure implementation at RNPP-2 is 2012. Habitability of these MCRs andECRs for severe accidents at neighboring unit should be further analyzed.
For all plants habitability of MCRs and ECRs in case of a severe accident is limited in time.
All Ukrainian nuclear power plants have training centers that include full-scope simulators (not forsevere accident). Personnel are trained to EOP and regularly exercises are performed at local andnational level.
Special emergency exercises on Fukushima related scenarios have been performed in 2011 at each site.
The local and national utility crisis centers, the SNRIU crisis centers are connected and can share plantmonitored data. On-site NPP crisis centers are equipped with an automated radiation situation
monitoring system (ASKRO) which is in service at each NPP. The system consists of automatedmonitoring points and allows receiving online information from the monitoring points. In addition, thecomputer code (CADO) for conducting systematic data analysis, performing prognosis of radiation
state for all settlements within 30-kilometers zone around NPP are available.
To ensure possibility of informing local and central power authorities on expected dose loads on
population and providing prognoses and recommendations on personnel and population protection,
operating NPPs use decision making support system (DMSS) in emergency situations, which havebeen developed for NPP surveillance zones (SZ). NNEGC "Energoatom" continues implementation of
DMSS improvement program at NPPs (all NPPs equipped in 2013). These tools will be installed atnational level for Energoatom but also at SNRIU.
For the Chernobyl site, the organizational provisions include: ChNPP Site Emergency Work Manager(SEWM), Coordination and management body – SEWM Headquarters or the ChNPP Facility
Commission for the issues of emergencies; Permanent management body – Emergency Preparedness
and Response Department; ChNPP emergency teams and groups.
There are 293 staff members in the various emergency units.
Two protective structures (each for 1500 persons), constructed for earthquakes of intensity 6, canbe used in case of accident. These structures include the following: double-system ventilation; power
supply (power grid and DG); drinking and service water inventory; autonomous fire extinguishingsystem; individual protection equipment, and devices for radiation survey and dosimetry monitoring,
medicines.
4.2.1.2

Procedures and guidelines for accident management

Symptom based EOP for power states are implemented at all Ukrainian NPPs. Development of EOP
for the shutdown state of reactors and SAMGs are in progress.
Severe accident management provisions (SAMG, dedicated hardware means and equipment
qualification in severe accident conditions) have not yet been implemented for the Ukrainian NPPs.
Work on SAM has been started in 2005-2008, is part of the C(I)SIP and has been accelerated after24

Fukushima by regulatory request. Currently, vulnerability analysis of power units in severe

accident conditions has been carried out; SAM strategies and associated equipment for its
implementation have been identified. SAMG are to be put into implementation at Rivne-1 andSouth Ukraine-1 by the end of 2012. A number of the safety upgrades (see para. 4.2.3.2) isunder implementation that covers all main severe accident phenomena (hydrogen combustion,
over-pressurization, etc.).
These safety upgrades should be implemented to avoid large releases to the environment after
core melt and consequent reactor vessel rupture, since existing safety system will not be helpful on thelatest phase of the severe accident propagation without support of the dedicated SAM system.
Procedures are said to be in-place to mutually secure one NPP by the others (e.g. using one unit tosupply power to the affected unit). Some specific procedures are described for Chernobyl site andconcern the management of pools cooling.
4.2.1.3

Hardware provisions for severe accident management

No hardware provisions for SAM have been implemented until now (e.g. for hydrogen control, invessel core melt retention, primary pressure control). PARs are installed at several plants but havebeen designed for DBAs only. The requirements for most of these provisions are under investigationin the C(I)SIP.
The design of the Ukrainian WWER NPPs includes emergency SG feedwater with three pumps andthree independent safety trains (passive and active ECCS, CHRS), each train powered by a specific
DG.
In a situation where a reactor core melt cannot be avoided, the report lists the following, currently
available, equipment for SAM:
– Pressurizer Pilot-Operated Relief Valves (PRZ PORV) opening or use of the emergency gas
evacuation system to decrease the primary pressure,– Capability of adding water to the SG with existing or mobile equipment,– Recovery of in-vessel water makeup with existing equipment,– Recovery of cooling function of the containment using the spray system,– Passive condenser in RNPP (WWER440 only).
For instrumentation, under the conditions of SBO and complete discharge of batteries, it remains
possible to access to some key measures (RCS and containment pressure using mobile manometers,
temperature in the reactor and main coolant piping using mobile millivoltmeters or resistance boxes on
the racks of the in-core monitoring system).
The survivability of existing equipment and their qualification in SA conditions has not yet beenaddressed and is part of the national upgrade programme.
4.2.1.4

Accident management for events in the spent fuel pools

The SFP in a WWER-1000 is located inside the reactor containment. The SFP in WWER-440 is
located outside the reactor containment but inside the secondary reactor building. The report concludes
on the need to reinforce the SFP water makeup and cool-down through:– Restoration of power supply to normal SFP makeup and cooling pumps;– Water injection into the SFP from independent MDGPU or from the fire extinguishing system;– Possibility of SFP passive heat removal.
For WWERs 1000, the report provides an indication of the total quantity hydrogen that could be
generated during a spent fuel accident (2200-3800 kg) and concludes that the quantity is similar to thecase of reactor core melt with Molten Corium/Concrete Interaction (MCCI). It concludes that PARs
(which are to be implemented) may be efficient to control hydrogen in case of spent fuel pooldewatering. However, it can be mentioned that the efficiency of PARs is not necessarily linked to thetotal mass of hydrogen produced but mainly to the kinetics of hydrogen production.
It should be noted that the existing analysis of SA in Ukraine (in L2 PSA) do not specifically consider
the inter-dependencies of reactor core melt and possible sent fuel pool fuel melt. The lessons learned
from the Fukushima accident suggest that spent fuel pool cooling after a reactor melt (and possible

25

damage induced by hydrogen combustion in the containment) needs to be addressed in a SAM
program. This issue will be addressed differently depending on whether the SFP is inside or outside
the containment as both configurations can lead to specific difficulties to overcome.
Vulnerability analyses of Ukrainian NPPs in case of severe accidents are currently underway. They
include analysis of the applicability of strategies for rated power and shutdown states.
For Chernobyl, the report indicates a very large delay for pool dewatering, the impossibility ofhydrogen production by zirconium oxidation and slow kinetics of fuel degradation even in the case offull dewatering.
4.2.1.5

Evaluation of factors that may impede accident management and capability to severe
accident management in multiple units case

The Ukrainian national report provides general information on the local and national organization todeal with an extreme external event affecting multiple units. During the country visit the robustness ofthe organization has been discussed.
The impact of a severe accident on accessibility (MCR and ECR) has not yet been analyzed and may
be a relevant cause of a cliff edge effect in the case of evacuation. A bunkered crisis center is available
on each site and protected against radiation. According to the regulatory requirement “Seismic designsof NPPs” PNAE G-5-006-87, crisis centers (on-site and off-site ones) are referred to seismic stability
category III. It is noted here that the crisis centers are less resistant against seismic hazards than thesafety systems.
The report does not comment on the feasibility of the first actions (with local personnel, taking into
account the fact that site access may not be possible in the first hours after an initiating event) if all
NPPs on a site are simultaneously affected by an extreme external event. The regulator has indicated,in an answer to a question during the topical review meeting, that resources are available on-site to
manage all actions requested in SBO multi-unit event EOP to avoid core melt for all reactors or to
avoid large release if core melt cannot be avoided on one reactor. Capability to avoid site evacuationand loss of control after core melt in one reactor is achieved by realization of emergency actions aimed
at localization of radioactivity within containment of an emergency unit and minimization of radiationconsequences of accident on NPP site. If there is insufficient radiation protection means for on-site
personnel will be used. The amount of radiation protection equipment stored in emergency sets at NPP
is sufficient to equip personnel in emergency conditions, including all personal on site.

4.2.2

Margins, cliff edge effects and areas for improvements

4.2.2.1

Strong points, good practices

The reviewers identified the following points as good practices:High level of redundancy of SSCs and power supply (DGs) in Ukrainian WWER appears to be astrong point which offers many possibilities and flexibility for accident management; someextensive additional safety upgrades to the original design are implemented to prevent severe
accidents (AEFS, various electrical interconnections, redundant emergency response provisions),– The large water inventory of WWER plants increases the time available for SAM. Codecalculations (assuming SBO condition at nominal power with no RCS rupture), show that for
WWERs there is more than 6 h to restore core cooling functions. This time is to be confirmed
during the country visit.
– The risk of common mode failure is being addressed through additional mobile equipment thatshould allow for quick connection and should be stored in a safe area,– Some prompt actions already implemented: mobile DG for ChNPP, set of targeted emergency
exercises conducted at all NPPs, including ChNPP,– Existence of comprehensive plans for short- and medium-term improvement measures under the
on-going government program.
In addition, emergency exercises on long term SBO type of scenarios were conducted at all Ukrainian
NPPs. Upon their results, measures were identified to improve on-site emergency response taking into
account Fukushima-related phenomena.
–26

4.2.2.2

Weak points, deficiencies (areas for improvements)

SAM provisions (SAMG, dedicated hardware means and equipment qualification in severe accident
conditions) have not yet been implemented for the Ukrainian NPPs and it is an area for improvement.
In the present situation, cliff edge effects during severe accident progression remain possible.
Nevertheless, vulnerability analysis of power units in severe accident conditions has been carried out,
SAM strategies and associated equipment have been identified.
It can also be noted that the connection points for mobile equipments have not yet been fully
implemented; however, they are under consideration.

4.2.3

Possible measures to increase robustness

4.2.3.1

Upgrading of the plants since the original design

Ukrainian NPPs upgrades have so far focused on the prevention of core damage (e.g. replacement of
PRZ PORV, Steam Generator Safety Valve (SG SV), SG makeup, control of ECCS flow rate, control
of primary to secondary leaks). Some of these upgrades are additionally useful for mitigation of severe
accidents.
4.2.3.2

Ongoing upgrading programmes in the area of accident management

According to the report, SA related requirements were mainly associated with C(I)SIP. In the 2010
version of this program the following topics were included:
EOP for shutdown reactor states (measures N° 19293, 29203, 39203 “Improvement of the emergency
operating procedures for reduced power and shutdown states”),
SAMG (“Program for Analysis of Severe Accident and Development of SAMG” PM-D.041.491-09).
The following measures were addressed:
SAMG development and substantiation;
implementation of measures for hydrogen concentration reduction in the containment in case of
beyond design basis accidents;
implementation of hydrogen control system in SG and MCP compartments and in pressurizer
compartment ;implementation of hydrogen concentration monitoring system in the containment for case of beyond
design basis accidents;
preservation of the containment integrity in case of interaction with corium (active core melt) at theex-vessel phase of severe accident;
development and implementation of measures for diagnostics in case of severe accident,
qualification of I&C and communication lines for severe accident conditions;power supply to the system in full discharge batteries (to 8 hours) and subsequent connection to
MDGs.

4.2.4

New initiatives from operators and others, and requirements or follow up actions
from Regulatory Authorities: modifications, further studies, decisions regarding
operation of plants

4.2.4.1

Upgrading programmes initiated/accelerated after Fukushima

Measures identified from the lessons of the Fukushima accident and the ENSREG stress test review
have been incorporated into the ‘Comprehensive Safety Improvement Program’ (updated in 20112012) by the utility and approved by the regulator. It is the intention to accelerate the implementationof the following actions:– SAMG development and implementation (WWERs 1000&440);– Implementation of H2 concentration reduction measures in the containment (WWER1000&440)
for BDBA situations

27

–
–
–
–

Installation of H2 concentration monitoring system in the containment for BDBA scenarios;
Preservation of the containment integrity if there is interaction with corium (active core melt) at
the ex-vessel phase of severe accident,
Enhancement of systems that aim to ensure MCR and ECR habitability and accessibility,
Development, and implementation, of measures for diagnostics in the case of a severe accident.

Additionally, shortly after the Fukushima accident (i.e. in April 2011) the regulator requested
implementation of the filtered containment venting system for all WWER-1000 and the end of
2011 for WWER-440 units.
4.2.4.2

Further studies envisaged

See previous chapter.
4.2.4.3

Decisions regarding future operation of plants

The regulator required implementation of SAMGs and containment filtered venting systems for
WWER-1000 if the utility seeks a license for LTO (SNRIU Board Resolution No. 13 of 24-25
November 2011). Under this resolution, RNPP must complete SAMGs for Units 1 (WWER 440) in
2012.

4.3

Peer review conclusions and recommendations specific to this area

The following ongoing activities have been identified as important in the context of the peer review:– Resolution of the non-full compliance with IAEA NS-R-1 (for equipment qualification,
consideration of severe accidents, NPP seismic resistance, completeness of probabilistic anddeterministic safety analysis and post-accident monitoring) is still on-going for all Ukrainian NPPs.
– SAM provisions have not yet been implemented for the Ukrainian NPPs. However, following
regulatory requests extensive activities have been on-going for several years, and have been
escalated in 2011 based on first Fukushima Daiichi lessons and results of stress tests. The
implementation must a have a high level of priority due to the possibility of cliff-edge effects inthe case of a severe accident.
– The reinforcement of the on-going national program on plant safety improvements;
The following topics are submitted as recommendations for consideration by the Ukrainian regulator:– it should be demonstrated, with a high degree of confidence, that the key functions needed for
SAM can be achieved. In particular, provisions against cliff-edge effects on accident progression
should be addressed in priority (hydrogen management, control, reliability of RCS
depressurization function in severe accident condition);– a strategy and program for the qualification of equipment needed in severe accident conditions
should be implemented;– the risk induced simultaneously by reactor and SFP in case of a severe accident should be assessed(for example in L2 PSA);– the analysis of SFP accident in various configurations in order to underwrite EOP and SAMGs;– the robustness of the means to cool the SFP even after core melt should be improved. If SFP is
inside the containment, a means to cool the SFP should be ensured even if some internal structures(pipes) in the containment have been damaged by an hydrogen combustion;– further investigation of the habitability of MCRs and ECRs in case of a severe accident;– consideration of the protection of population in regards to the SAM provisions;– for site with several units should be verified in details the feasibility of immediate actions required
to avoid core melt, prevent large release, and avoid site evacuation for a disaster affecting morethan one unit at a particular site;– enhanced seismic capabilities for the building hosting the crisis center should be assessed.
The schedule for hardware and procedures implementations should stay under strict control of theregulator.

28

List of acronyms
AC
AEFS
BDBA
C(I)SIP
ChNPP
DBA
DBE
DBF
DC
DE
DG
DSF
ECCS
ECR
EDG
EFWS
ESWS
ENSREG
EOP
EPS
I&C
IAEA
ISF
ISF-1
KhNPP
LOCA
LTO
LOOP
MCCI
MCE
MCP
MCR
MDGPU
MDG
NHL
NNEGC
NPP
PGA
PRZ PORV
PSA
PSR
RCS
RLE
RNPP
RV
SAM(G)
SAR
SBO
SEWM
SFP
SFS

Alternating Current
Additional Emergency Feedwater System
Beyond Design Basis Accident
Comprehensive (Integrated) Safety Improvement Program for
Ukrainian NPPs
Chornobyl Nuclear Power Plant
Design Basis Accident
Design Basis Earthquake
Design Basis Flood
Direct Current
Design Earthquake
Diesel Generator
Dry Spent Fuel Storage Facility
Emergency Core Cooling System
Emergency Control Room
Emergency Diesel Generator
Emergency Feedwater System
Essential Service Water System
European Nuclear Safety Regulators Group
Emergency Operating Procedures
Emergency Power Supply
Instrumentation and Control
International Atomic Energy Agency
Interim Spent Fuel Storage Facility
Wet Interim Spent Nuclear Fuel Storage Facility
Khmelnitsky Nuclear Power Plant
Loss of Coolant AccidentLong Time Operation
Loss of Off-site Power
Molten Corium/Concrete Interaction
Maximum Calculated Earthquake
Main Coolant Pump
Main Control Room
Mobile Diesel Generator and Pumping Unit
Mobile Diesel Generator
Normal Headwater Level
National Nuclear Energy Generating Company Energoatom
Nuclear Power Plant
Peak Ground Acceleration
Pressurizer Pilot-Operated Relief Valve
Probabilistic Safety Analysis
Periodic Safety Review
Reactor Coolant System
Review Level Earthquake
Rivne Nuclear Power Plant
Relief Valve
Severe Accident Management (Guidelines)
Safety Analysis Report
Station Black Out
Site Emergency Work Manager
Spent Fuel Pool
Spent Fuel Storage

29

SG
SG SV
SHA
SNRIU
SSC
SUNPP
UHS
WWER
WENRA
ZNPP

Steam Generator
SV Steam Generator Safety Valve
Seismic Hazard Assessment
State Nuclear Regulatory Inspectorate of Ukraine
Structure, System and Component
South Ukraine Nuclear Power Plant
Ultimate Heat Sink
Vodo-Vodyanoi Energetichesky Reactor; Water-Water Energetic Reactor
Western European Nuclear Regulators’ Association
Zaporizhzhya Nuclear Power Plant

30